# AI in cybersecurity: how defenders use it and where it falls short

> How AI is used in cybersecurity: malware and phishing detection, UEBA, SOAR and LLM triage agents, what the evidence shows, the limits and how to start.

- URL: https://computese.com/teh-crucial-role-in-ai-in-cybersecurity/
- Author: Duong Quan Nguyen, CEO, Computese
- Published: 2024-07-25
- Updated: 2026-09-25
- Topics: Security, AI & automation

## In short
- Defenders use AI to read more than people can: classifiers block malware, phishing and payment fraud, behaviour analytics (UEBA) flags accounts acting out of character, automation contains attacks, and LLM agents triage alerts and explain their verdicts.
- The evidence is positive but correlational: in IBM's 2026 report, extensive use of security AI and automation came with breach costs USD 1.93 million lower, and Microsoft researchers linked Security Copilot to 30.13% faster incident resolution.
- AI moves the false-positive trade-off rather than removing it, and the models are targets too: MITRE ATLAS documents evasion of commercial malware and phishing detectors, and OWASP ranks prompt injection first among LLM risks in 2026.
- Keep people on the consequential decisions: give AI agents the least privilege they need, require approval before they change data or accounts, and log what they read and did.
- Small and mid-sized organizations should start with the AI already in their licences, such as Defender for Business in Microsoft 365 Business Premium, and check it is switched on before buying more.

AI in cybersecurity means defenders using machine learning and large language models to find and stop attacks in more data than people can read. Classifiers block malware, phishing and fraud, behaviour analytics flag accounts acting out of character, automation contains attacks, and LLM agents triage alerts and explain their verdicts. People still make the consequential decisions.

This guide explains how each of those works, from the vendors' own technical documentation, what the evidence says about results, and where AI fails: false positives, attacks on the models themselves, and prompt injection once an AI agent can act. It ends with how a small or mid-sized organization can start, usually with AI it already pays for. The attacker's side, from AI-written phishing to cloned voices, is covered in [the dual role of AI in cybersecurity](https://computese.com/the-dual-role-of-ai/).

## What AI does in cybersecurity

"AI" in a security product covers several techniques. Machine learning models that score files and emails have been standard for years; the newer layer is large language models (LLMs) that read an alert, query logs and write up what they found. Each answers a different problem:

| Job                                 | Technique                                     | Examples, as of September 2026                      | What a person still does                |
| ----------------------------------- | --------------------------------------------- | --------------------------------------------------- | --------------------------------------- |
| Stop malware on laptops and servers | ML classifiers on the device and in the cloud | Microsoft Defender Antivirus, Defender for Endpoint | Investigates what got through           |
| Filter phishing and spam            | Content, sender and behaviour models          | Gmail, Microsoft Defender for Office 365            | Reports misses, tunes thresholds        |
| Find compromised accounts           | Anomaly detection and UEBA                    | Microsoft Sentinel UEBA                             | Decides whether unusual means malicious |
| Contain attacks quickly             | SOAR playbooks, automatic attack disruption   | Sentinel playbooks, Microsoft Defender XDR          | Approves or reverses actions, restores  |
| Triage and investigate alerts       | LLM assistants and agents                     | Security Copilot, Gemini in Google SecOps           | Checks the verdict, carries out the fix |
| Stop payment fraud and scam pages   | Risk scoring, an on-device LLM                | Stripe Radar, Chrome Safe Browsing                  | Reviews the flagged cases               |

The common thread is a division of labour, and it is how AI and security teams actually work together: models read and score at machine speed, and people decide what the output means.

## How machine learning detects malware on endpoints

Signatures, the hash or byte pattern of a known sample, miss anything new or repacked. Machine learning models learn the features malicious files and behaviours share, so they can judge a file nobody has seen before. Microsoft's [technical overview of Defender Antivirus](https://learn.microsoft.com/en-us/defender-endpoint/adv-tech-of-mdav) shows how the work is split:

- **On the device**, lightweight models reach a verdict within milliseconds, with specialized models for the file types attackers abuse, such as Windows executables, PowerShell, Office macros, JavaScript and PDF.
- **In the cloud**, when the client meets a file it cannot judge, it sends metadata or the file itself. File-type and feature-specific models, including what Microsoft calls adversary-hardened monotonic models, analyze a featurized description, and stacked ensemble classifiers combine their results into a verdict before the file runs.
- **For harder cases**, the file is held from running while deep neural networks classify its full contents and reply within seconds, or it is detonated in a sandbox where deep learning classifiers judge what it does.

[Cloud protection](https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-defender-antivirus) is on by default, and Microsoft recommends keeping it on: it identifies new threats quickly, sometimes before any device is infected.

![A laptop holds a suspicious orange file behind a pause sign while a card of its features travels to a cloud of models, which sends a block verdict back before the file can run.](https://computese.com/images/blog/teh-crucial-role-in-ai-in-cybersecurity/hybrid-ml.f1329f01ee-1536.webp)

*Only files the laptop cannot judge make the round trip, which is why cloud protection matters most for threats nobody has seen before.*

Once a program runs, behaviour-based models watch what it does. In Defender for Endpoint, [behavioural blocking and containment](https://learn.microsoft.com/en-us/defender-endpoint/behavioral-blocking-containment) detects threats on the device through machine learning, blocks and remediates them automatically, and uses a feedback loop to stop the same threat on other devices; the on-device blocking and the feedback loop are both on by default. Microsoft lists techniques these capabilities have blocked, among them credential dumping from LSASS, process hollowing, tampering with antivirus and pass-the-hash attacks. Endpoint detection and response (EDR) collects the signals behind these detections and groups related alerts into incidents, so an analyst can see how an attack unfolded. For a single PC rather than a fleet, see [how to choose antivirus software](https://computese.com/choose-the-right-antivirus-software-for-your-pc/).

## How AI filters phishing and spam email

In a 2022 overview, Google said [Gmail's filters](https://workspace.google.com/blog/identity-and-security/an-overview-of-gmails-spam-filters) block more than 99.9 percent of spam, phishing and malware from reaching inboxes. They use machine learning powered by user feedback: the models weigh the sending IP address, domains and subdomains, whether bulk senders authenticate, and what users do, so marking a message as spam is a training signal.

Attackers write to get past classifiers, with homoglyphs (lookalike characters), invisible characters and keyword stuffing. In November 2023 Google introduced [RETVec](https://security.googleblog.com/2023/11/improving-text-classification.html), a text vectorizer built to resist those tricks; swapping it into the Gmail spam classifier improved the spam detection rate over the baseline by 38% and reduced the false positive rate by 19.4%.

Microsoft's [anti-phishing policies](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about) expose the same ideas as settings:

- **Every Microsoft 365 mailbox** gets spoof intelligence, a first contact safety tip and unauthenticated sender indicators.
- **Mailbox intelligence** in Defender for Office 365 uses AI to learn each user's patterns with frequent contacts. A vendor you write to often who shares your CEO's name is not flagged; a first-time sender using that name can be. It is on by default, but acting on its detections needs a second setting, "Enable intelligence for impersonation protection", which is off by default.
- **Phishing email thresholds**, from 1 (Standard) to 4 (Most aggressive), set how strictly the machine learning verdicts are applied. Each step treats lower-confidence verdicts as very high confidence, and Microsoft notes that false positives become more likely.

## How anomaly detection and UEBA find compromised accounts

Classifiers judge an object: this file, this email. Anomaly detection judges behaviour against a baseline: this account, on this device, at this hour. User and entity behaviour analytics (UEBA) applies that to identities, devices and applications, which is how it catches a stolen password that no signature would flag.

In Microsoft Sentinel, [UEBA](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics) uses machine learning to build behavioural profiles for users, hosts, IP addresses and applications, and compares current activity with them to surface compromised accounts, insider attacks and lateral movement. It weighs deviations across locations and devices, from the entity's own history, from its peer group (the top 20 peers, ranked from security group membership, mailing lists and other associations) and from organization-wide patterns.

![Grey dots mark one account's sign-ins along a band of normal activity. One sign-in, from an unfamiliar phone far away, is marked in orange and tips a gauge.](https://computese.com/images/blog/teh-crucial-role-in-ai-in-cybersecurity/baseline.bc1c9c8d4a-1536.webp)

*A sign-in is not suspicious in itself; it is suspicious for this account, which is exactly what a baseline measures.*

Sentinel produces two scores, and Microsoft's own example shows why unusual is not the same as malicious:

| Score                  | Range | Measures                                    | A user's first Azure operation     |
| ---------------------- | ----- | ------------------------------------------- | ---------------------------------- |
| Investigation priority | 0–10  | How unusual one event is, in near real time | High: it is a first-time event     |
| Anomaly score          | 0–1   | Anomalous behaviour across events, by ML    | Low: first-time actions are common |

UEBA is included with Sentinel at no extra cost; its data follows standard Sentinel pricing. It is only as good as the sources you connect, starting with Microsoft Entra ID, Defender for Identity and Office 365.

## How SOAR and automated response contain attacks

Security orchestration, automation and response (SOAR) is the automation layer of a security operations center (SOC). Microsoft's [Sentinel documentation](https://learn.microsoft.com/en-us/azure/sentinel/automation/automation) starts from the problem: alert volumes so large that many alerts are ignored and many incidents never investigated. Sentinel, a SIEM, answers with automation rules that tag, assign or close incidents and create task lists for analysts, and playbooks built on Azure Logic Apps that handle enrichment, response and remediation across other systems, automatically or on demand.

A playbook is only as good as the rule that starts it. The newer step is a model deciding when to act. Microsoft Defender's [automatic attack disruption](https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption) correlates signals from endpoints, identities, email and SaaS apps into one high-confidence incident, identifies the assets the attacker controls, and contains them by isolating devices, disabling or suspending users and revoking sessions. Microsoft says it maintains a confidence level of 99% or higher for containment actions, measured on real production data, validates new detectors in audit mode first, and uses graph models, boosted decision trees, neural networks and small language models. The SOC stays in control of investigation and recovery: every automatic action can be undone, and critical assets can be excluded.

| Question            | Rule-based SOAR playbook                | Automatic attack disruption              | LLM triage agent                            |
| ------------------- | --------------------------------------- | ---------------------------------------- | ------------------------------------------- |
| What decides to act | A rule you wrote                        | Correlated ML detectors, high confidence | The model's reasoning over the alert        |
| Typical output      | Enrich, tag, notify, isolate on a match | Contain a device, disable a user         | A verdict, a summary, suggested next steps  |
| Who tunes it        | You                                     | Microsoft; you set exclusions            | The vendor, plus your feedback              |
| Main risk           | Stale rules, broken integrations        | Disrupting a legitimate user or server   | A wrong verdict, or one an attacker steered |

## How LLM assistants help triage and investigate alerts

An LLM can read an alert, pull context from logs and threat intelligence, and explain its conclusion in plain language. Microsoft and Google both now offer agents that do this first pass of triage. How these models produce their answers, and why they can be fluent and wrong, is covered in [what generative AI is](https://computese.com/the-rise-of-generative-ai/).

[Microsoft Security Copilot](https://learn.microsoft.com/en-us/copilot/security/microsoft-security-copilot) runs in a standalone portal and inside Defender XDR, Sentinel, Intune and Entra, with plugins for third-party services such as ServiceNow. Documented uses include turning complex alerts into actionable summaries with step-by-step response guidance, writing KQL queries from natural language, analyzing suspicious scripts and drafting reports. Security Copilot grounds each prompt with data from its plugins before the language model sees it, and the analyst reviews the response. Microsoft began [including it in Microsoft 365 E5 and E7](https://learn.microsoft.com/en-us/copilot/security/security-copilot-inclusion) in a rollout that started on November 18, 2025: 400 Security Compute Units (SCUs) a month per 1,000 paid user licences, up to 10,000, at no additional cost. Microsoft says usage beyond that will later be throttled, with extra SCUs at USD 6 each, pay as you go.

Security Copilot's [Phishing Triage Agent](https://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agent) in Microsoft Defender uses LLM-based analysis, file and URL detonation, screenshot analysis and threat intelligence to classify each user-reported email as a real threat or a false positive, and explains its reasoning. It resolves the false alarms itself; confirmed threats stay open for an analyst. Analysts correct it in plain language, and the corrections go into the agent's memory for similar alerts. It needs Defender for Office 365 Plan 2 and Security Copilot capacity, and Microsoft recommends a dedicated agent identity with only the permissions it requires.

[Gemini in Google Security Operations](https://docs.cloud.google.com/chronicle/docs/secops/gemini-secops) builds searches from natural language, generates YARA-L detection rules and playbooks from a prompt, answers threat intelligence questions and summarizes cases with suggested resolutions. Google's [Triage and Investigation Agent](https://docs.cloud.google.com/chronicle/docs/secops/triage-investigation-agent) runs an investigation plan on an alert (searches, Google Threat Intelligence enrichment, command-line analysis, process tree reconstruction) and returns a disposition, true or false positive, with a confidence level, an explanation and suggested next steps. Google says most investigations finish in about 60 seconds, with a 20-minute maximum.

Does it help? The best measurement so far is observational: across more than 150 organizations, Microsoft researchers found that adopting Security Copilot was [associated with a 30.13% reduction in mean time to resolve incidents](https://arxiv.org/abs/2411.03116) three months later, against a control group. Because organizations chose whether to adopt it, the authors note, the study cannot prove cause.

## How AI detects payment fraud and scam pages

[Stripe Radar](https://docs.stripe.com/radar/transaction-risk-prevention) scores each payment in real time with adaptive AI models that use hundreds of risk factors and data from across Stripe's network of businesses. Where the plan shows it, the risk score runs from 0 to 99: by default, 65 or above is elevated risk and 75 or above is high risk. High-risk payments are blocked by default; elevated-risk payments go through, or into a manual review queue on plans that support one. Refunding and reporting fraudulent payments feeds back into the models.

Browsers apply the same idea to scam pages. Since Chrome 137 in May 2025, [Chrome runs the on-device Gemini Nano model](https://blog.google/security/using-ai-to-stop-tech-support-scams-in/) on pages that show signs of a tech support scam, such as use of the keyboard lock API, to extract signals like the page's intent; Safe Browsing makes the final call with other intelligence. Google's reason for working on the device: the average malicious site exists for less than 10 minutes. The signals are sent only for users who opted into Enhanced Protection.

## What the evidence says about AI in security operations

The most quoted figures come from IBM's [Cost of a Data Breach Report 2026](https://www.ibm.com/reports/data-breach). Ponemon Institute conducted it, and IBM sponsored and analyzed it, from breaches at 602 organizations between March 2025 and February 2026, according to [IBM's July 29, 2026 announcement](https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average).

| 2026 finding                                                                   | Figure                                  |
| ------------------------------------------------------------------------------ | --------------------------------------- |
| Global average cost of a data breach                                           | USD 4.99 million, up 12%, a record high |
| Saving from extensive use of AI and automation in security, compared with none | USD 1.93 million                        |
| Organizations that have not adopted these tools in security operations         | One in four                             |
| Organizations using agents for threat detection and containment                | More than 50%                           |
| Organizations applying agents to vulnerability management                      | 18%                                     |

Read these as correlations, not experiments. Organizations that use security AI extensively can differ in other ways, such as staffing and budget, so not all of the USD 1.93 million gap is the AI's doing. Still, IBM's figures and the Security Copilot study point the same way: automated detection and triage go with faster resolution and cheaper breaches. IBM also warns that the low use of agents in vulnerability management leaves known exposures open while AI shortens the time attackers need to exploit them.

## Where AI in cybersecurity falls short

AI changes how defenders spend their time. It does not remove the first two problems below, and it creates the third.

### False positives and alert fatigue

Every detector trades missed attacks against false alarms. In a [2022 USENIX Security study](https://www.usenix.org/conference/usenixsecurity22/presentation/alahmadi), SOC practitioners confirmed high false positive rates from their tools, and most of those turned out to be benign triggers: real alarms explained by legitimate activity. Validating them is tedious, and the authors link it to alarm burnout and eventually desensitization. They ask for alerts that are reliable, explainable, analytical, contextual and transferable.

AI moves this trade-off; it does not escape it. A stricter phishing threshold catches more phishing and flags more good mail. UEBA ranks a first-time action high for investigation and low as an anomaly. An agent that closes false positives saves time only while its mistakes are rare, which you learn by sampling what it closed, not from its confidence score.

### Attackers study and fool the models

A classifier is software an attacker can study. NIST's taxonomy of [adversarial machine learning](https://csrc.nist.gov/pubs/ai/100/2/e2025/final) (AI 100-2 E2025, March 2025) sorts attacks on predictive models into evasion, poisoning and privacy attacks. It notes such attacks have been shown against malware classifiers, PDF malware detection, Android app classification and network intrusion detection, and that needing very low false negative and low false positive rates at once makes these models susceptible.

[MITRE ATLAS](https://atlas.mitre.org/) catalogues these attacks in practice; as of September 2026 it lists 16 tactics, 208 techniques, 40 mitigations and 73 case studies. Two involve security products:

- In a [2019 exercise](https://atlas.mitre.org/studies/AML.CS0003), researchers studied a vendor's public talks and patents, used verbose logging to see its reputation scoring, found a secondary model that could override the main one, and fused attributes of known good files into malware to bypass CylancePROTECT.
- In a [December 2022 incident](https://atlas.mitre.org/studies/AML.CS0032) reported by Norton Research Group, phishing sites blurred, cropped and stretched brand logos to evade the visual-similarity model of a commercial phishing detector. That model was fooled; other components of the system still flagged the sites.

The practical lessons: prefer products that layer independent detectors, keep model scores away from anyone who does not need them, and ask vendors how they harden their models.

### Prompt injection and data leakage when AI agents act

The [OWASP Top 10 for LLM Applications 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/), published in August 2026, ranks prompt injection first (LLM01), sensitive information disclosure second (LLM02) and excessive agency third (LLM03). It states the root cause plainly: LLMs make no architectural distinction between instructions and data, so there is no clean equivalent to the parameterized queries that stopped SQL injection.

Security is a hard case, because much of what a security agent reads was written by the attacker: the phishing email being triaged, the command line in an alert, the page behind a reported link. A hidden instruction can try to steer the agent toward a benign verdict, and for an agent that resolves false positives itself, a benign verdict closes the alert. Leakage is the other risk: an assistant grounded in your logs and mailboxes can repeat what it read, and OWASP counts tool-call arguments, retrieved passages and logs as disclosure channels, not only the final answer. AI systems are targets in their own right; in IBM's 2026 study, more than 20% of organizations reported a breach targeting AI models or applications, most often through compromised APIs, applications or plug-ins (27%) or cloud misconfigurations affecting AI workloads (27%).

OWASP's mitigations become rules for security agents:

1. Give each agent its own identity with the least privilege it needs, as Microsoft recommends for its phishing agent.
2. Require explicit human confirmation before any privileged, irreversible or externally visible action, and show the reviewer the exact action, not a summary.
3. Apply the Rule of Two, which OWASP adopts from Meta: an agent with untrusted input, access to sensitive data and the ability to change state or communicate externally needs per-action human approval. Many security agents have all three.
4. Treat writes to an agent's memory, analyst feedback included, as privileged changes, and log them.

![An email with a hidden orange hook enters an AI agent drawn as a box with a gear. The agent's action toward a mailbox, a server and a folder stops at a padlocked gate until a check mark is added.](https://computese.com/images/blog/teh-crucial-role-in-ai-in-cybersecurity/approval-gate.a9b53fc695-1536.webp)

*The agent will read whatever the attacker wrote; the gate is what stops a hidden instruction from becoming an action.*

## Why people stay in the loop

AI and security teams work well together because each covers the other's weakness. Models read everything, quickly and consistently; people know the business, notice what does not fit and carry the accountability. The NIST AI Risk Management Framework (AI RMF 1.0, January 2023; NIST says a revision is in progress) describes [human-AI configurations](https://airc.nist.gov/airmf-resources/airmf/appendices/app-c-ai-risk-management-and-human-ai-interaction/) that range from fully autonomous to fully manual, and suggests collecting data on how often, and why, people overrule AI output. Its [core](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/) asks organizations to define, assess and document processes for human oversight (MAP 3.5), and to have mechanisms and assigned responsibility to supersede, disengage or deactivate an AI system whose performance or outcomes are inconsistent with its intended use (MANAGE 2.4).

The vendors' designs follow this. Attack disruption leaves investigation and recovery to the SOC and makes every action reversible. Google's triage agent suggests next steps to the analyst. Microsoft's phishing agent leaves confirmed threats to a person. Keeping a human in the loop has its own failure mode, which OWASP names: approval fatigue degrades reviewer judgment at volume. Ask people to approve few, consequential actions, and let rules handle the routine ones.

> [!IMPORTANT]
> Before you switch on an agent, write down which actions it may take alone, which it may only propose, and which stay with people. Blocking a known-bad file is the first kind; disabling an executive's account or deleting mail across the organization is not.

## How a small or mid-sized organization can start

You do not need a SOC or a new platform. Most organizations already pay for more AI-based protection than they use.

1. **Start with the AI in the licences you have.** Microsoft 365 Business Premium includes [Defender for Business](https://learn.microsoft.com/en-us/defender-business/mdb-overview), built for up to 300 users, with next-generation protection, EDR, automated investigation and remediation, and automatic attack disruption. In Google Workspace, administrators can let Gmail [automatically apply future recommended settings](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection) for phishing and malware protection. If you take card payments through Stripe, Radar is already scoring them.
2. **Check it is switched on everywhere.** Confirm cloud protection and behavioural blocking are on, that impersonation protection can act and not only observe, and that every laptop and phone is enrolled; our guide to [managing security on your team's devices](https://computese.com/how-to-manage-cybersecurity-on-your-devices/) covers enrolment.
3. **Name who reads the alerts.** Automation contains an attack; a person still investigates it and restores what was contained. An alert nobody reads protects nobody.
4. **Add an LLM assistant where you have volume.** With E5 or E7 licences, Security Copilot is included, or on its way in Microsoft's rollout: start with incident summaries and the phishing triage agent, and review a sample of the alerts it closes each week before relying on it.
5. **Set rules before any agent acts:** its own least-privilege identity, approval before it changes data or accounts, and a log of what it saw and did.
6. **Measure before and after:** false positives, time to triage and time to resolve, so you know whether a tool earns its cost.

None of this replaces patching, phishing-resistant sign-in (our [man-in-the-middle guide](https://computese.com/understanding-man-in-the-middle-mitm-attacks/) shows why codes can be relayed), backups and least privilege for people; our [cybersecurity checklist for small business](https://computese.com/cybersecurity-best-practices/) puts those in order.

For an outside view of what you expose, our [security testing service](https://computese.com/services/security-testing/) scans your sites, servers and cloud accounts on a schedule and ranks findings by real risk, with every result reviewed by an engineer and false positives removed. When a workflow needs AI you do not have yet, our [AI and automation service](https://computese.com/services/ai-automation/) builds it so that nothing changes in your systems until a rule or a person approves it; and when the answer is a feature you already pay for, we say so.

## Key terms
- **Machine learning (ML) detection**: Models trained on labelled examples that score new files, emails, sign-ins or payments as malicious or benign, including samples no signature has seen before.
- **EDR (endpoint detection and response)**: Software on laptops and servers that records process, file and network activity, raises alerts on suspicious behaviour and can isolate a device.
- **SIEM**: Security information and event management: a platform that collects logs from across an organization and runs detections and searches over them. Microsoft Sentinel and Google Security Operations are examples.
- **UEBA**: User and entity behaviour analytics: machine learning that builds a baseline of normal activity for each user, device, IP address and application, and scores deviations from it.
- **SOAR**: Security orchestration, automation and response: automation rules and playbooks that enrich, route and act on alerts across tools, so a person does not repeat each step by hand.
- **LLM assistant**: A large language model connected to security tools that answers questions, writes queries and summarizes incidents. Run as an agent, it also investigates and classifies alerts.
- **False positive**: An alert on activity that is not malicious. A steady stream of them causes alert fatigue, where analysts start to ignore alarms, real ones included.
- **Adversarial machine learning**: Attacks that fool, poison or extract information from ML models, such as altering malware so that a classifier scores it as benign.
- **Prompt injection**: Instructions hidden in content a language model reads, such as an email, a web page or a log entry, that change what the model does.
- **Human in the loop**: A design in which a person reviews or approves an AI system's output before it takes effect, at least for actions that are consequential or hard to reverse.

## Common questions

### How is AI used in cybersecurity?

Mostly to read and score more data than people can. Machine learning classifies files, emails and payments; behaviour analytics flags accounts that act unlike themselves; automation contains attacks in progress; and LLM assistants summarize incidents and triage alerts. Security teams decide what the output means and approve the actions that matter.

### Will AI replace cybersecurity analysts?

Not on current evidence. Vendors design their agents to hand confirmed threats, remediation and restoration to people, and the NIST AI Risk Management Framework asks organizations to define human oversight. AI takes over repetitive triage, which shifts analysts toward investigation, tuning and judgment calls.

### What is the difference between SOAR and an AI agent?

A SOAR playbook runs steps you defined when a rule matches, so the same alert always gets the same response. An AI agent chooses its own investigation steps and returns a verdict with its reasoning, which copes with messier cases but can be wrong or manipulated. Many teams use both: the agent triages, and a playbook carries out approved actions.

### Can attackers fool AI security tools?

Yes. MITRE ATLAS documents researchers bypassing a commercial ML malware detector in 2019, and phishing sites that distorted brand logos to evade a visual-similarity model in 2022. Layers help: in the phishing case, other parts of the detection system still caught the sites.

### Is Microsoft Security Copilot included in Microsoft 365?

For Microsoft 365 E5 and E7 customers, yes, in a rollout that started on November 18, 2025: 400 Security Compute Units a month per 1,000 paid user licences, up to 10,000, at no additional cost. Customers without E5 or E7 licences, including Business Premium, buy capacity on Microsoft's existing pricing model.

### What is UEBA in cybersecurity?

User and entity behaviour analytics learns what normal looks like for each user, device, IP address and application, then scores activity that deviates from that baseline, from the entity's peers or from the organization as a whole. It surfaces compromised accounts, insider threats and lateral movement that match no known signature.

## Sources
1. [Advanced technologies at the core of Microsoft Defender Antivirus](https://learn.microsoft.com/en-us/defender-endpoint/adv-tech-of-mdav), Microsoft Learn
2. [Cloud protection and Microsoft Defender Antivirus](https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-defender-antivirus), Microsoft Learn
3. [Behavioral blocking and containment](https://learn.microsoft.com/en-us/defender-endpoint/behavioral-blocking-containment), Microsoft Learn
4. [Understanding Gmail's spam filters](https://workspace.google.com/blog/identity-and-security/an-overview-of-gmails-spam-filters), Google Workspace Blog
5. [Improving Text Classification Resilience and Efficiency with RETVec](https://security.googleblog.com/2023/11/improving-text-classification.html), Google Online Security Blog
6. [Anti-phishing policies in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about), Microsoft Learn
7. [Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics), Microsoft Learn
8. [Automation in Microsoft Sentinel: Security orchestration, automation, and response (SOAR)](https://learn.microsoft.com/en-us/azure/sentinel/automation/automation), Microsoft Learn
9. [Automatic attack disruption in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption), Microsoft Learn
10. [What is Microsoft Security Copilot?](https://learn.microsoft.com/en-us/copilot/security/microsoft-security-copilot), Microsoft Learn
11. [Security Copilot inclusion in Microsoft 365 E5 and E7](https://learn.microsoft.com/en-us/copilot/security/security-copilot-inclusion), Microsoft Learn
12. [Microsoft Security Copilot Phishing Triage Agent in Microsoft Defender](https://learn.microsoft.com/en-us/defender-xdr/phishing-triage-agent), Microsoft Learn
13. [Gemini in Google SecOps overview](https://docs.cloud.google.com/chronicle/docs/secops/gemini-secops), Google Cloud
14. [Triage alerts with the Triage Agent](https://docs.cloud.google.com/chronicle/docs/secops/triage-investigation-agent), Google Cloud
15. [Generative AI and Security Operations Center Productivity: Evidence from Live Operations](https://arxiv.org/abs/2411.03116), arXiv (Bono, Grana, Xu; Microsoft)
16. [Transaction risk prevention](https://docs.stripe.com/radar/transaction-risk-prevention), Stripe Documentation
17. [Using AI to stop tech support scams in Chrome](https://blog.google/security/using-ai-to-stop-tech-support-scams-in/), Google
18. [Cost of a Data Breach Report 2026](https://www.ibm.com/reports/data-breach), IBM
19. [IBM Study: One in Four Malicious Breaches are AI-Enabled, Costing Companies $6 Million on Average](https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average), IBM Newsroom
20. [99% False Positives: A Qualitative Study of SOC Analysts' Perspectives on Security Alarms](https://www.usenix.org/conference/usenixsecurity22/presentation/alahmadi), USENIX Security 2022 (Alahmadi, Axon, Martinovic)
21. [NIST AI 100-2 E2025: Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations](https://csrc.nist.gov/pubs/ai/100/2/e2025/final), NIST
22. [MITRE ATLAS](https://atlas.mitre.org/), MITRE
23. [Bypassing Cylance's AI Malware Detection (AML.CS0003)](https://atlas.mitre.org/studies/AML.CS0003), MITRE ATLAS
24. [Attempted Evasion of ML Phishing Webpage Detection System (AML.CS0032)](https://atlas.mitre.org/studies/AML.CS0032), MITRE ATLAS
25. [OWASP GenAI LLM Top 10 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/), OWASP Gen AI Security Project
26. [AI RMF 1.0, Appendix C: AI Risk Management and Human-AI Interaction](https://airc.nist.gov/airmf-resources/airmf/appendices/app-c-ai-risk-management-and-human-ai-interaction/), NIST Trustworthy and Responsible AI Resource Center
27. [AI RMF 1.0, Section 5: AI RMF Core](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/), NIST Trustworthy and Responsible AI Resource Center
28. [What is Microsoft Defender for Business?](https://learn.microsoft.com/en-us/defender-business/mdb-overview), Microsoft Learn
29. [Advanced phishing and malware protection](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection), Google Workspace Admin Help